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DETAILED ACTION 

This is a response to Applicant's Amendments filed on May 21 , 2007. 
Claims 1-21 were originally pending. 

Claim 19 has been cancelled. Claims 1, 2, 11, 12, and 21 have been amended. 
Claims 1-18, and 20-21 are pending. 

Response to Arguments 

Replacements sheets 1 through 4 are accepted. 

Amendments to 1 , 2, 1 1 , 12, and 21 are acceptable and previous Objections for lack of 
antecedent basis, and rejections with regard to 112, second paragraph, have been 
withdrawn. 

1 . Applicant's arguments with regard to rejection of claims 12, 15, and 20, under 35 
use 102(b) have been fully considered but they are not persuasive. 

a. Applicant alleges that "Manduley does not describe or suggest generated 
any type of authorization key, let alone generating an authorization in response 
to determining to authorize change in a feature set." "Determination to activate 
software features occur in a different device, namely the data center..." 
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The Examiner notes that IVIanduley discloses a step generating an authorization 
key [Col 6, Ln 22-24 - discloses generating a code that represents the 
application or features or both for which activation is requested, -This does not 
specifically read on the authorization key, but this is evidence of a pending 
authorization key because this data is used for the determination of generating 
an authorization key.] [Col 8, Ln 29-33 - The data center generates a code 
(reading specifically on authorization key) when entered into device will cause 
device to update its activation map to activate the requested application or 
features.] This code is both the authorization key, and the feature change code 
since this code authorizes the change (being a valid code), and has data that 
implements the feature changes. The "Authorization Device" of the Applicant 
acts to determine and generates an authorization key and feature change code. 
This corresponds to the Data Center, acting to determine whether to authorize 
the device from granting the feature change being requested. 

Claim 21 rejection is withdrawn under 102(b) because of the means plus function 
interpretation. 

2. Applicant's arguments with respect to claims 1-8, 10, 11, 13, 14, and 16-18 have 
been considered but are moot in view of the new ground(s) of rejection. Prior cited art, 
Manduley, in combination with Leovac and Parfenov et al. are used. 



Application/Control Number: 10/677,775 Page 4 

Art Unit: 2132 

Claim Rejections • 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form 
the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or .described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

1. Claims 12, 15, 16, and 20 are rejected under 35 U.S.C. 102(b) as being 
unpatentable over Manduley [US Pat No. 5,956,505]. 

With regard to claim 12, Manduley discloses a method of authorizing change in the 
available features in a software-implemented feature set containing a plurality of 
features (Abstract), comprising the steps: 

receiving a token (Col. 7, lines 53-54, Fig. 4-A, step 206 - discloses a request 
code entered by the user and input into the data center which reads on token); 

obtaining identification information and feature related information from the token 
(Col. 7, lines 62-65, Fig. 4-A, step 208 - discloses obtaining what program or 
features are requested and information identifying the device - which reads on 
identification information and feature related information); 
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in response to a determination to authorize change in the feature set, the further 
steps of: 

Using the identification information to generate an authorization key [Col 
8, Ln 29-33 - The data center generates a code (reading on authorization 
key) when entered into device will cause device to update its activation 
map to activate the requested application or features.]; 

forming a feature change code from the authorization key and information 
related to the authorized feature set [Col 8, Ln 29-35 - The authorization 
key and feature change code is an integrated code.]; and 

issuing the feature change code (Col. 8, lines 29-32 - discloses 
generating a code that will cause updating of activation map of the device 
to activate the requested features). 

With regard to claim 15, Manduley discloses the identification information comprises 
data relating to at least one of a software identification number; a Device identification 
number; a Subcriber identification number (Col. 4, lines 43-47). 

With regard to claim 16, Manduley teaches the method as claimed in claim 12, wherein 
the identification information also comprises hardware version number data or software 
version number data [Col 5, Ln 20-25 - Configuration record is evidence for hardware 
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and software version data; note determination of whettier "stand-alone system" and any 
necessary liardware.]. 



With regard to claim 20, Manduley discloses the token contains payment information in 
respect to the requested feature alteration (Col. 8, lines 24-28). 



Claim Rejections • 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action; 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
. invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 

(1966), that are applied for establishing a background for determining obviousness 

under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1 . Claims 17-18 are rejected under 35 U.S.C. 103(a) as being unpatentable over 



Manduley [US FN 5956505] and further in view of Barrus et al. [US 2003/0204721 A1]. 
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With regard to claim 17, the invention of IVIanduley teaches the method as claimed in 
claim 12, where the step of obtaining information from the token comprises the step of 
deriving encrypted data from the received token [US PN 5956505, Col 6, Ln 49-50]. 
Manduley does not explicitly teach where the step of obtaining infomriation from the 
token comprises deriving a secret key and using the secret key as a decryption key to 
decrypt the encrypted data to obtain feature related information. 
Barrus et al. teaches the method of obtaining information from a token that comprises 
deriving a cyrptographic key used to decrypt encrypted data [US 2003/0204721 Al , Pg 
2, Par 0022]. 

It would have been obvious to one of ordinary skilled in the art at the time of invention to 
be able to derive a secret cryptographic key as taught by Barrus et al. from the token of 
Manduley, and be able to use the derived secret key to decrypt the encrypted data also 
derived from the token. The suggestion/motivation for combining would have been to 
cryptographically secure the token request that would also be unique and specific to the 
request. This prevents the use of obtained token request information to other token 
requests, thereby increasing security. Barrus et al. and Manduley are analogous art 
because they solve the problem by adding another security layer. 

With regard to claim 18, the invention of Manduley teaches the method as claimed in 
claim 12, where the step of generating an authorization key comprises the step of using 
the identification data. 
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Manduley does not teach where the step of generating an authorization l<ey also 
comprises forming a secret key from the identification data. 

Barrus et al. teaches the method of deriving a secret l^ey from an identification data of a 
token [US 2003/0204721 A1, Pg 2, Par 0021-0022 -The token (from which keys can be 
derived) can be any identifier data.]. 

It would have been obvious to one of ordinary skilled in the art at the time of invention to 
be able to derive a secret cryptographic key as taught by Barrus et al. from the 
identification data contained in the token of Manduley, and be able to use the derived 
secret key to decrypt encrypted data that can also be derived from the token. The 
suggestion/motivation for combining would have been to cryptographically secure the 
token request that would also be unique and specific to the request. This prevents the 
use of obtained token request information to other token requests, thereby increasing 
security. Barrus et al. and Manduley are analogous art because they solve the problem 
by adding another security layer 

2. Claims 13-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Manduley [US PN 5956505] and further in view of Parfenov et al. [US 2002/0138728 
Al]. 



With regard to claim 13, the invention of Manduley teaches the method as claimed in 
claim 12, but Manduley does not teach wherein a random number is also obtained from 
the received token. 
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Parfenov et al. teaches wherein a random number is also obtained from the received 
token [US 2002/0138728 Al, Pg 3, Par 0030 - The second message contains the same 
random number that was sent in the first message.] 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
include a random number In a request token. The suggestion/motivation would have 
been to add another layer of security for preventing a "replay attack" because a random 
number generated is specific to the time the request and authorization is made. 
Manduley and Parfenov et al. are analogous art because they solve the problem of a 
"replay attack." 

With regard to claim 14, the invention of Manduley teaches the method as claimed in 
claim 13, but Manduley does not teach wherein the random number is used in the step 
of generating the authorization key. 

Parfenov et al. teaches wherein the random number is used in the step of responding 
back from an initial message or request. [US 2002/0138728 Al, Pg 3. Par 0030 - The 
second message contains the same random number that was sent in the first 
message.] 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
use the random number in the step of responding back from the request token which in 
Manduley's invention comprise of generating the authorization key. The 
suggestion/motivation would have been to add another layer of security for preventing a 
"replay attack" because a random number generated is specific to the time the request 
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and authorization is made. IVIanduley and Parfenov et al. are analogous art because 
tliey solve the problem of a "replay attack." 

3. Claims 1-2, 5-6, 9-1 1 , and 21 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Manduley [US PN 5956505] and further in view of Leovac [US PN 
6668375 B1]. 

With regard to claim 1, Manduley teaches a method of changing the available features 
in a software- implemented feature set containing a plurality of features, comprising the 
steps: forming a token from identification information and feature related information 
[US PN 5956505, Col 6, Ln 46-48] and issuing the token from a communication device 
[US PN 5956505, Col 7, Ln 57-60]; receiving the token at an authorization device and 
obtaining identification information and desired feature related information from the 
token [US PN 5956505, Col 7, Ln 57-60]; in response to a determination to authorize 
change in the feature set, the further steps of: using the identification Information to 
generate an authorization key [US PN 5956505, Col 6, Ln 22-24 - discloses generating 
a code (containing ID information) that represents the application or features or both for 
which activation is requested, -This is evidence of a pending authorization key because 
this data is used for the determination of generating an authorization key.] [US PN 
5956505, Col 8, Ln 29-33 - The data center generates a code (reading specifically on 
authorization key) when entered into device will cause device to update its activation 
map to activate the requested application or features.]; forming a feature change code 
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from the authorization l<ey and information related to an authorized feature set and 
issuing the feature change code from the authorization device [US PN 5956505, Col 8, 
Ln 29-35 - The authorization key and feature change code is an integrated code.]; and 
receiving the feature change code at the communication device and obtaining the 
authorization key and information related to the authorized feature set from the feature 
change code [US PN 5956505, Col 8, Ln 29-35 - The authorization key and feature 
change code is an integrated code.]; and implementing the authorized feature set if the 
authorization key integrated feature change code is valid [US PN 5956505, Col 8, Ln 
29-35]. 

Manduley does not teach generating a local authorization key using the identification 
information; comparing the authorization key obtained from the feature change code 
[Authorization key is integrated with the feature change code.] with the local 
authorization key; and implementing the authorized feature set if the authorization key. 
obtained from the feature change code and the local authorization key match. 

On the other hand Leovac teaches a method of changing the available features in a 
software-implemented feature set containing a plurality of features [US PN 6668375 B1 , 
Col 1, Ln 6-10] comprising generating a local authorization key using the identification 
information [US PN 6668375 B1 , Col 3, Ln 53-58]; comparing the authorization key 
obtained from the feature change code with the local authorization key [US PN 6668375 
B1, Col 3, Ln 58-60. Authorization key is integrated with the feature change code. Note 
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Figure 2, ie "key + exclusions" data.]; and implementing the authorized feature set if the 
authorization key obtained from the feature change code and the local authorization key 
match [US PN 6668375 B1 . Col 3, Ln 60-65.]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
extend the generation and use of the authorization key as taught by Leovac into 
Manduley's invention. The suggestion/motivation for further extending the generation 
and use of such an authorization key would be to add a layer of security by ensuring 
that such authorized changes is specific to the feature change request [US 6668375 B1 , 
Col 1, Ln 35-37], and that the feature change code comes from a trusted entity [Only a 
trusted entity would know the hash/digest function used to generate the authorization 
key.]. Manduley and Leovac are both analogous art because they are both in the same 
field of endeavor pertaining to providing new options to already installed software. 

With regard to claim 2, the combined invention of Manduley and Leovac teaches a 
method of a communication device for changing the available features in a software- 
implemented feature set containing a plurality of features, comprising the steps: forming 
a token from identification information and feature related information [US PN 5956505, 
Col 6, Ln 46-48] and issuing the token to an authorization device [US PN 5956505, Col 
7, Ln 57-60]; receiving a feature change code from the authorization device and 
obtaining an authorization key and information related to an authorized feature set from 
the feature change code [US PN 5956505, Col 7, Ln 57-60]; generating a local 
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authorization l<ey using the identification information [US PN 6668375 B1. Col 3, Ln 53- 
58]; comparing the received authorization key obtained from the feature change code 
with the local authorization key [US PN 6668375. B1 . Col 3, Ln 58-60]; and 
implementing the authorized feature set if the received authorization key obtained from 
the feature change code and the local authorization key match [US PN 6668375 B1. Col 
3. Ln 60-65]. 

With regard to claim 5, the combined invention of Manduley and Leovac teach the 
method as claimed in claim 1 , wherein the identification information comprises data 
relating to at least one of a software identification number; a Device Identification 
number; a Subscriber Identification Number [US PN 5956505, Col. 4, lines 43-47]. 

With regard to claim 6, the combined invention of Manduley and Leovac teach the 
method as claimed in claim 5, wherein the identification information also comprises 
hardware version number data or software version number data [US PN 5956505, Col 
5, Ln 20-25 - Configuration record is evidence for hardware and software version data; 
note determination of whether "stand-alone system" and any necessary hardware.]. 

With regard to claim 9, the combined invention of Manduley and Leovac teach the 
method as claimed in claim 1 , where the step of generating a local, authorization key 
uses a non-reversible operation [A digest/hash function is a non-reversible operation.]. 
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With regard to claim 10, the combined invention of IVIanduley and Leovac teach the 
method as claimed in claim 1 , where the token contains payment infomnation in respect 
of the requested feature alteration [US PN 5956505, Col 8, Ln 24-28]. 

Claims 11 and 21 are rejected because it is the apparatus performing the method of 
claims 2 and 1 respectively. 

4. Claims 7-8 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Manduley [US PN 5956505] and further in view of Leovac [US PN 6668375 81] and 
Barrus et al. [US 2003/0204721 A1]. 

Claim 7 and 8 are rejected because it is the same subject matter as claim 17 and 18 
respectively. 

5. Claims 3-4 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Manduley [US PN 5956505] and further in view of Leovac [US PN 6668375 B1] and 
Parfenov et al. [US 2002/0138728 Al]. 

Claims 3 and 4 are rejected because it is the same subject matter as claim 13 and 14 
respectively. 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Martin Jeriko P. San Juan whose telephone number Is 
571-272-7875. The examiner can normally be reached on M-F 8:30a - 6:00p EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Infonnation Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications Is available through Private PAIR only. For 
more Information about the PAIR system, see http://pair-dlrect.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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